Modular multiplication and division algorithms based on continued fraction expansion

Transcription

1 205 IEEE 22nd Symposum on Computer Arthmetc Modular multplcaton and dvson algorthms based on contnued fracton expanson Mourad Goucem UPMC Unv Pars 06 and CNRS UMR 7606, LIP6, 4 place Jusseu, F-75252, Pars cedex 05, France Contact: goucem.mourad@gmal.com Abstract In ths paper, we provde new methods to generate a class of algorthms computng modular multplcaton and dvson. All these algorthms rely on sequences derved from the Eucldean algorthm for a well chosen nput. We then use these sequences as number scales of the Ostrowsk number system to construct the result of ether the modular multplcaton or dvson. I. INTRODUCTION Contnued fractons are commonly used to provde best ratonal approxmatons of an rratonal number. Ths sequence of best ratonal approxmatons (p /q ) N s called the convergents sequence. In the begnnng of the 20 th century, Ostrowsk ntroduced number systems derved from the contnued fracton expanson of any rratonal α []. He proved that the sequence (q ) N of the denomnators of the convergents of any rratonal α forms a number scale, and any nteger can be unquely wrtten n ths bass. In the same way, the sequence (q α p ) N also forms a number scale. In ths paper, we show how such number systems based on contnued fracton expansons can be used to perform modular arthmetc, and more partcularly modular multplcaton and modular dvson. The presented algorthms are of quadratc complexty lke many of the exstng mplemented algorthms [2, Chap. 2.4]. Furthermore, they present the advantage of beng only based on the extended Eucldean algorthm, and to ntegrate the reducton step. In the followng, we wll frst ntroduce notatons and some propertes of the number systems based on contnued fracton expansons n Secton II. Then we descrbe the new algorthms n Secton III. Fnally, we gve elements of complexty analyss of these algorthms n Secton IV, and perspectves n Secton VI. II. NUMBER SYSTEMS AND CONTINUED FRACTIONS A. Notatons Frst, we gve some notatons on the contnued fracton expanson of an rratonal α wth 0 <α< [3]. We call the tals of the contnued fracton expanson of α the real sequence (r ) N defned by r 0 = α, r =/r /r. We denote (k ) N the nteger sequence of the partal quotents of the contnued fracton expanson of α. They are computed as k = /r.wehave α = := [0; k,k 2,...,k + r ]. k + k k + r We wrte p /q the th convergent of α. The sequences (p ) N and (q ) N are nteger valued and postve, p =[0;k,k 2,...,k ]. q We wll also wrte (θ ) N the postve real sequence of ( ) (q α p ) whch we call the sequence of the partal remanders as they are related to the tals by r = θ /θ. Hereafter, we recall the recurrence relatons to compute these sequences, p = p 0 =0 p = p 2 + k p, q =0 q 0 = q = q 2 + k q, θ = θ 0 = α θ = θ 2 k θ. We also wrte η = q α p the sequence of the sgned partal remanders, whch elements are of sgn ( ). The sequence (η ) N of the sgned partal remanders can be computed as (( ) θ ) N /5 $ IEEE DOI 0.09/ARITH

2 B. Related number systems over rratonal numbers In ths secton, we present two number systems based on the sequences of the sgned partal remanders (η ) N and the denomnators of the convergents (q ) N of an rratonal α. They have been extensvely studed durng the second part of the 20 th century [], [4]. Property II. ([, Proposton ]). Gven (q ) N the denomnators of the convergents of any rratonal 0 < α<, every postve nteger N can be unquely wrtten as m N =+ n q where the followng Markovan condtons are verfed: { 0 n k, 0 n k, for 2, n =0f n + = k + Ths number system assocated to the (q ) N s named the Ostrowsk number system. To wrte an nteger n ths number system, we use a classcal greedy decomposton algorthm (Algorthm ). The rank m s chosen such that q m >N. Algorthm : Integer decomposton n Ostrowsk number system. nput : N N, (q ) <m m output: n such that N =+ n q tmp N ; 2 m; 3 whle do 4 n tmp/q ; 5 tmp tmp n q ; 6 ; Property II.2 ([, Proposton 2]). Gven (η ) N the sequence of the sgned partal remanders of any rratonal 0 <α<, every real β, wth 0 β<can be unquely wrtten as β = α + + b η where the followng Markovan condtons are verfed: { 0 b k, 0 b k, for 2, b =0f b + = k +. There also exsts two other number systems that are dual to these two. One decomposes ntegers n the bass (( ) q ) N and the other decomposes reals n the bass of the unsgned partal remanders (θ ) N []. The second Markovan condton then becomes b + =0f b = k. An algorthm to wrte real numbers n the (θ ) N number scale has been proposed by Ito [5]. It proceeds by teratng the mappng T :(α, β) (/α /α,β/α β/α ). C. Related number systems over ratonal numbers In ths subsecton, we consder α = p/q ratonal. We recall that the contnued fracton expanson of a ratonal s fnte. We denote p q =[0;k,k 2,...,k n ] the contnued fracton expanson of p/q, and recall p n = p and q n = q. We can stll wrte any nteger N usng the fnte sequence (q ) n and a greedy algorthm. However, the frst quotent N/q n wll not respect the Markovan condtons for N q n, as the condton s not defned for ths quotent (there s no k n+ ). Nevertheless, the Markovan condtons wll stll hold for ntegers N<q n, snce the keypont n the Ostrowsk number system s that there exsts q m such that q m >N [4]. The (η ) <n number system also stll holds under one supplemental condton: β must be ratonal wth precson at most q (.e. the denomnator of β must be less or equal than q). III. MODULAR ARITHMETIC AND CONTINUED FRACTION In ths secton, we consder α = a/d. We hghlght that the same decomposton (b,...,b n+ ) can be nterpreted n two ways dependng on the number system used. In the Ostrowsk number system, we obtan an nteger N whereas n the number scale (η ) N, we obtan the reduced value of Nα mod []. Hence, we wll use the fact that studyng an nteger a modulo d s smlar to consderng the ratonal a/d modulo. Ths enables us to use propertes II. and II.2 to compute modular multplcaton and dvson. A. Modular arthmetc and contnued fracton Frst, we brefly recall how contnued fracton expanson and the Eucldean algorthm are lnked. We wrte (θ ) N the nteger sequence of remanders when computng gcd(a, d). Ths sequence s composed of decreasng values less than d. We also wrte (η ) N 38

3 the sequence (( ) θ ) N. We obtan the followng recurrence relaton, and recall the recurrence relaton over the (θ ) N sequence of partal remanders of the contnued fracton expanson of a/d : θ = d θ 0 = a θ = θ 2 θ 2 /θ θ θ = θ 0 = a/d θ = θ 2 θ 2 /θ θ. It has to be notced that θ = dθ as the extended Eucldean algorthm compute the relatons θ = ( ) (q a p d) and θ =( ) a (q d p ). In partcular, ths mples that the same partal quotents, noted k, are obtaned when computng both sequences. Fnally, we notce that the extended Eucldean algorthm gves the Bezout s dentty wth θ n = ( ) n (q n a p n d) = gcd(a, d), and q n the nverse of a f a s nvertble modulo d (gcd(a, d) =). B. Modular multplcaton Now, gven a, b Z/dZ, we wrte c = a b mod d the nteger 0 c<dsuch that ab ab/d d = c. We can observe that the decompostons presented n propertes II. and II.2 are both unque and both need the same Markovan condton over ther coeffcents. Hence, we can nterpret the same decomposton n both bass. Theorem III.. Gven a, b Z/dZ, and (q ) n, (η ) n from Eucldean algorthm on a and d, f we wrte b n the (q ) n number scale as then n+ b =+ b q, n+ a b mod d = a + b η. Proof: Frst, we consder b<q n, t can be wrtten n the Ostrowsk number system as n b =+ b q, and the coeffcents b respect the Markovan condton of the Ostrowsk number system. Hence, n α b = α + b q α. By defnton, η = q α p, thus n α b = α + b η + n b p. θ k q b b rem Table I EXECUTION OF THE PROPOSED MODULAR MULTIPLICATION ALGORITHM WITH d =45, a =7AND b =30. As the coeffcents b s verfy the Markovan condton, the unqueness of the decomposton n property II.2 gves 0 α + n b η < and n b p N. Hence, n α b mod = α + b η. By multplyng ths nequalty by d, asα = a/d and η = η d, we obtan n a b mod d = a + b η. whch fnalzes the proof of the theorem for b<q n. Now f b q n and b = b n+ q n + b wth b <q n the remander of the dvson of b by q n, b can be unquely wrtten n the Ostrowsk number system. Furthermore, as η n =0, b n+ η n =0, whch fnshes the proof. Example III.. We gve n Table I the sequences nvolved n theorem III.2 wth d = 45, a = 7 and b =24. We denote (b rem ) N the sequence of remanders generated by the greedy decomposton of b n the (q ) N number scale. One can notce that b = , and that b a =24 7 = 3 mod d = C. Modular dvson Inversely, gven a, b Z/dZ, wth a nvertble modulo d (gcd(a, d) = ) we can effcently compute a b mod d. Theorem III.2. Gven a, b Z/dZ wth gcd(a, d) =, and (q ) n, (θ ) n from Eucldean algorthm on a and 39

4 d, f we wrte b n the (θ ) <n number scale as n+ b = b θ, n+ then f we denote c = b ( ) q, a b mod d {c, d + c}. Proof: The proof of correctness s smlar to the one of theorem III., usng the facts that θ = θ d and that θ =( ) (q α p ). Now, the greatest nteger c s clearly the one assocated to the decomposton (k, 0,k 3, 0,...,k n ) when n s odd. However, k q = q q 2 by defnton, whch mples (n )/2 =0 k 2+ q 2 = q n. The smallest nteger that can be returned s clearly the one assocated to the decomposton (0,k 2, 0,k 4,...,k n ) when n s even. Once agan, as k q = q q 2,we get n/2 k 2 q 2 = q n. Hence, d < n+ b ( ) q <d, that s to say, the result needs at most a correcton by an addton by d. Example III.2. We gve n Table II the sequences nvolved n theorem III.2 wth d =45, a =7and b =30. We here notce that b = , and that b a =30 8 = 5 mod d = We menton that we also tred to decompose b n the (η ) n sgned remanders number scale and evaluate ths same decomposton n the (q ) n number scale to compute modular dvson. We used Ito T 2 transform [5] T 2 : (α, β) (/α /α, β/α β/α). In practce, t returns the rght result wthout the need of any correcton. However, as the decomposton computed by Ito T 2 transform does not verfy the same Markovan condtons as n the Ostrowsk number system, we were not able to gve a theoretcal proof that t always returns the reduced result of the modular dvson. θ k q b b rem Table II EXECUTION OF THE PROPOSED MODULAR DIVISION ALGORITHM WITH d =45, a =7AND b =30. IV. ELEMENTS OF COMPLEXITY ANALYSIS In ths secton, we ntroduce elements of complexty analyss of the proposed modular multplcaton algorthm based on theorem III.. The same analyss holds for the dvson. Ths analyss s hghly eased by prevous works on the Eucldean algorthm complexty []. A. Worst-case complexty The ntroduced algorthms compute (q ) n and (η ) n. Ths can be computed usng the classcal extended Eucldean algorthm n O(log (d) 2 ) bnary operatons. Second, the bnary complexty of the decomposton n (q ) n as n algorthm s bounded by the complexty of computng the sequence (q ) n snce the same number of quotents are computed, wth values of smlar sze, and the quotents b are bounded by the quotents k (Markovan condton). Hence, the greedy decomposton has complexty n O(log (d) 2 ). To fnsh the worst-case complexty analyss, evaluatng the sum to return the fnal result can also be done n O(log (d) 2 ). B. Average number of quotents k The average number of quotents k computed by the Eucldean algorthm has been extensvely studed [6], [7], [8]. In partcular, Porter [9] showed that t s bounded by 2 ln(2) π 2 ln(d)+(4p +2, 5) + O(d /6+ɛ ) () for every ɛ>0 and P Porter s constant (P.47 and 2 ln(2)/π [0]). C. Average value of quotents k and b The average value of the quotents k s equal to Khnchn s constant (approxmately 2.69) [3, p. 93]. Furthermore, bg quotents are very unlkely to occur as 40

5 the quotents of any contnued fracton follow the Gauss- Kuzmn dstrbuton [3, p. 83] [7, p. 352], ) P(k = k) = log 2 ( (k +) 2. Ths typcally means that most of the dvsons computed n the Eucldean algorthm can be computed by subtracton effcently. By the same arguments, the coeffcents b of the decomposton n (q ) n can be computed by subtracton as they are also lkely small (as they are bounded by the k due to the Markovan condtons). In the modular multplcaton algorthm, the only quotent not followng the Gauss-Kuzmn dstrbuton s the coeffcent b n+ when gcd(a, d), as t corresponds to the quotent b/q n. Here, we prove the folowng theorem, showng that b n+ s stll lkely to be very small. Theorem IV.. Let a, d, b and N ntegers. If a and d are unformly chosen n [,N] and b s unformly chosen n [,d], then when N tends to nfnty, P(b n+ k) tends to [ k+ ζ(2) (k +) 3 ] +(k +)ζ(3). wth ζ(s) = + the Remann zeta functon. s Proof: Let U,U 2 and U 3 be three ndependent unform dstrbutons over [0, ]. We wrte a = U N, d = U 2 N and b = U 3 d. We denote A = {b <(k+)q n }, B = {gcd(a, d) k +}, B = {gcd(a, d) >k+} and B = {gcd(a, d) =}. Hence usng the law of total probablty we have A =(A B) (A B), = (A B ) ( ) (A B ), k+ >k+ = P(A B ) P(B ) ( ) P(A B ) P(B ). k+ >k+ As the B are dsjont events, we have P(A) = k+ P(A B ) P(B )+ + =k+2 P(A B ) P(B ). Frst, P(A B )=for k+ as b<d=gcd(a, d) q n (k +) q n. Hence, k+ + P(A) = P(B )+ P(A B ) P(B ). =k+2 Now we want to determne P(A B ) for k +2. Hereafter, to smplfy equatons, we wrte Q ( ) = P( B ) and C = {a = l} {d = m}. P(A B )=Q (A), N N = Q (C) Q (A C). l= m= However, Q (A C) = k + as b s unformly dstrbuted between and d = q n. If we consder the segment of length d and slce t n segments of length q n, t can be nterpreted as the probablty that b s n the frst k + slces. Hence P(A B )= N N l= m= = k + Q ({a = l} {d = m}) k +, N l= m= N Q ({a = l} {d = m}). As {a = l} and {d = m} are ndependent by hypothess (U and U 2 are ndependent), Q ({a = l} {d = m}) =Q ({a = l}) Q ({d = m}), and P(A B )= k + N N Q ({a = l}) Q ({d = m}). l= m= Now, we use the fact that the sum of the probabltes over the whole sample space always sum to to obtan P(A B )= k +. If we recaptulate, P(A) = k+ P(B )+ + =k+2 k + P(B ). Fnally, t s wdely known that P(B ) tends to ζ(2) 2 when N tends to nfnty [, p. 353]. Hence, we get lm P(A) = k+ N + ζ(2) 2 + [ k+ = ζ(2) =k+2 k (k +) ζ(2) 2, ] =k+2 3, 4

6 Probablty Fgure Max expected b n+ Cumulatve dstrbuton functon of the coeffcent b n+. whch equals to [ k+ ( ζ(2) + +(k +) 2 3 k+ [ k+ = ζ(2) (k +) 3 +(k +) ( + )], 3 3 )] Hence, usng Remann zeta functon defnton, we get the followng smplfcaton, whch s more convenent for computaton and has been used to generate Fg., lm N + P(A)=ζ(2) [ k+ (k +) 3 +(k+) ζ(3) Fgure shows the probablty dstrbuton of P(b n+ k). In partcular, we obtan P(b n+ 3) 92.5%. V. COMMENTS ON A PRACTICAL USE OF THESE ALGORITHMS Exstng algorthms for modular multplcaton are of two knds. They ether ntegrate the reducton, makng t possble to do all the computatons wth the nput precson (Blakley [2] and Takag [3]), or they rely on an effcent multplcaton of the arguments, and then effcently reduce ther product whch sze s the sum of the arguments sze (Barrett [4] and Montgomery [5]). All these algorthms are usually used n dfferent contexts, whether we compute many multplcatons by the same large values (Montgomery [5]) or small values (Takag[3]), or whether we compute few multplcatons. ]. by small values (Blakley [2]) or large values (Barrett [4]). The proposed algorthms are of the frst knd wth ntegrated reducton and do not need converson or pre-computaton. They clearly target contexts where few multplcatons of small values (because of the quadratc complexty) are computed. The proposed modular multplcaton seems to be of lttle nterest n practce n ts current form, as ts memory consumpton mght be hgh the sequences (θ ) N and (q ) N have to be stored entrely to decompose b and recompose the result even f t s of same complexty as competng methods (Blakley[2] and Takag[3]). Concernng the modular dvson, to our knowledge, all exstng algorthms requre to multply by an nverse whch need to be computed. In the proposed modular dvson, the modular multplcaton s ntegrated to the computaton of the nverse. Ths enables to partally cover the latency of the nverse computaton. Moreover, ts memory footprnt s low snce the computed sequences do not need to be stored. Frst experments wth a straghtforward 64-bt mplementaton show an encouragng speedup of 2.44x aganst GMP [6] low-level functons (mpn_gcd_ext, mpn_mul and mpn_tdv_qr). These arguments make t sutable n some context lke Gaussan elmnaton on a small dmenson matrx wth coeffcents n a fnte feld. For each row, several values are dvded by the same pvot. The proposed modular dvson helps coverng the latency of computng an nverse, seems adapted to decompose several nputs at the same tme (lke any greedy algorthm) and can be easly vectorzed (f a vectorzed nteger dvson nstructon s avalable). VI. PERSPECTIVES In ths paper, we presented an algorthm for modular multplcaton and an algorthm for modular dvson. Both are based on the extended Eucldean algorthm and are of quadratc complexty n the sze of the modulus,and do not requre pre-computaton or changng the nputs representaton. They present a theoretcal nterest snce t t the frst use of Ostrowsk number systems to ths purpose. Even though the proposed modular multplcaton algorthm n ts actual form s not relevant n practce, the modular dvson seems to be effcent as t ntegrate the multplcaton to the computaton of the nverse. Further nvestgatons have to be led to fnd optmal decomposton algorthms, that mnmze the number of coeffcents of the produced decomposton and ther 42

7 sze. Also, a supplemental effort s necessary to provde effcent software mplementaton of the modular dvson algorthm. VII. AKNOWLEDGEMENT Ths work was supported by the TaMaD project of the french ANR (grant ANR 200 BLAN ). Ths work has also been greatly supported and mproved by many helpful proof readngs and dscussons wth Jean- Claude Bajard, Valére Berthé, Perre Fortn, Stef Grallat and Emmanuel Prouff. REFERENCES [] V. Berthé and L. Imbert, Dophantne approxmaton, Ostrowsk numeraton and the double-base number system, Dscrete Mathematcs & Theoretcal Computer Scence, vol., no., pp , [2] R. Brent and P. Zmmermann, Modern computer arthmetc, vol. 8. Cambrdge Unversty Press, 200. [3] A. Y. Khnchn, Contnued fractons. Dover, 997. [4] A. Vershk and N. Sdorov, Arthmetc expansons assocated wth a rotaton of the crcle and wth contnued fractons, Sant Petersburg Mathematcal Journal, vol. 5, no. 6, pp. 2-36, 994. [5] S. Ito, Some skew product transformatons assocated wth contnued fractons and ther nvarant measures, Tokyo Journal of Mathematcs, vol. 9, no., pp. 5 33, 986. [6] B. Vallée, Eucldeans dynamcs, Dscrete and Contnuous Dynamcal Systems seres S, pp , [7] D. E. Knuth, The Art of Computer Programmng, vol. 2 (Semnumercal Algorthms). Addson-Wesley, second ed., 98. [8] L. Lhote and B. Vallée, Gaussan laws for the man parameters of the Eucld algorthms, Algorthmca, vol. 50, no. 4, pp , [9] J. W. Porter, On a theorem of Helbronn, Mathematka, vol. 22, no. 0, pp , 975. [0] D. E. Knuth, Evaluaton of Porter s constant, Computers & Mathematcs wth Applcatons, vol. 2, no. 2, pp , 976. [] G. H. Hardy and E. M. Wrght, An Introducton to the Theory of Numbers. Oxford Unversty Press, 6 th ed., [2] G. Blakley, A computer algorthm for calculatng the product ab modulo m, IEEE Transactons on Computers, vol. 32, no. 5, pp , 983. [3] N. Takag, A radx-4 modular multplcaton hardware algorthm for modular exponentaton, Computers, IEEE Transactons on, vol. 4, no. 8, pp , 992. [4] P. Barrett, Implementng the Rvest Shamr and Adleman publc key encrypton algorthm on a standard dgtal sgnal processor, n Advances n cryptology CRYPTO 86, pp , Sprnger, 987. [5] P. L. Montgomery, Modular multplcaton wthout tral dvson, Mathematcs of computaton, vol. 44, no. 70, pp , 985. [6] T. Granlund and the GMP development team, GNU MP, ed., January